Amendments to the Claims: 



This listing of claims will replace all prior versions, and listings, of claims 
in the application: 

Please amend the claims as follows: 

1 . (Currently Amended) A computer readable medium having stored thereon 
data representing instructions that, when executed by a processor, cause the 
processor to perform operations data structur e to ind e x an obj e ct captur e d during 
transmission from an origination address to a d e stination addr e ss, the data 
structur e comprising: 

generating for storage of objects captured during transmission from an 
origination address to a destination address: 

a source address field to indicate an origination address of the 

object; 

a destination address field to indicate a destination address of the 

object; 

a source port field to indicate an origination port of the object; 

a destination port field to indicate a destination port of the object; 

a content field to indicate a content type from a plurality of content 
types identifying a type of content contained in the object; and 

a time field to indicate when the object was captured : and 
storing data in the fields to create a tag, the tag indexing a captured object 
in storage. 

2. (Currently Amended) The data structur e computer readable medium of claim 
1, wherein the plurality of content types comprises JPEG, GIF, BMP, TIFF, PNG, 
Skintone, PDF, MSWord, Excel, PowerPoint, MSOffice, HTML, WebMail, 
SMTP, Telnet, Rlogin, FTP, Chat, GZIP, ZIP, TAR, C++ Source, C Source, 
FORTRAN Source, Verilog Source, C Shell, K Shell, Bash Shell, Plaintext, 
Crypto, LIF, Binary Unknown, ASCII Unknown, and Unknown. 
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3. (Currently Amended) The data structur e computer readable medium of claim 
1 , further comprising generating a device identity field to indicate a device that 
captured the object. 

4. (Currently Amended) The data s tructur e computer readable medium of claim 
1 , further comprising generating a protocol field to indicate the protocol that 
carried the object. 

5. (Currently Amended) The data structur e computer readable medium of claim 
1 , further comprising an instance field to indicate a number of the object in a 
connection. 

6. (Currently Amended) The data structure computer readable medium of claim 
1, further comprising generating an encoding field to indicate a how the object 
was encoded. 

7. (Currently Amended) The data structur e computer readable medium of claim 
1 , further comprising generating a size field to indicate the size of the object. 

8. (Currently Amended) The data structur e computer readable medium of claim 

1 , further comprising generating an owner field to indicate an entity that requested 
capture of the object. 

9. (Currently Amended) The data structur e computer readable medium of claim 
1 , further comprising generating a capture rule field to indicate a rule that 
triggered capture of the object. 

10. (Currently Amended) The data structur e computer readable medium of 
claim 1 , further comprising generating a signature field to store a signature of the 
object. 

1 1 . (Currently Amended) The data structure computer readable medium of 

claim 10, wherein the signature comprises a digital cryptographic signature. 
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12. (Currently Amended) The data structure computer readable medium of claim 
1 , further comprising generating a tag signature field to store a signature of the 
data structure. 

13. (Currently Amended) The data s tructure computer readable medium of 
claim 12, wherein the tag signature comprises a digital cryptographic signature. 

14. (Currently Amended) A computer readable medium having stored thereon 
data representing instructions that, when executed by a processor, cause the 
processor to perform operations tag storing r e lational data ov e r an obj e ct captur e d 
by a captur e syst e m, the relational data comprising: 

storing data associated with capture of an object by a capture system to 
create a tag that indexes the captured object in storage, the data comprising: 

an Ethernet controller MAC address of the capture system that 
captured the object; 

a source Ethernet IP address of the object; 

a destination Ethernet IP address of the object; 

a source TCP/IP port number of the object; 

a destination TCP/IP port number of the object; 

an IP protocol that carried the object when captured by the capture 

system; 

a canonical count of a number of the object within a TCP/IP 
connection; 

a content type of the object; 

an encoding that was used on the object; 

a [[the]] size of the object; 

a timestamp indicating when the capture system captured the 

object; 

a user who requested capture of the object; 
a capture rule that directed capture of the object; 
a hash signature of the object; and 
a hash signature of the tag. 
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15. (Currently Amended) The [[tag]] computer readable medium of claim 14, 
wherein the hash signature of the object comprises a digital cryptographic 
signature of the object. 

16. (Currently Amended) The [[tag]] computer readable medium of claim 15, 
wherein the hash signature of the tag comprises a digital cryptographic signature 
of the tag. 

17. (Currently Amended) The [[tag]] computer readable medium of claim 14, 
wherein the content type of the object is one of JPEG, GIF, BMP, TIFF, PNG, 
Skintone, PDF, MSWord, Excel, PowerPoint, MSOffice, HTML, WebMail, 
SMTP, Telnet, Rlogin, FTP, Chat, GZIP, ZIP, TAR, C++ Source, C Source, 
FORTRAN Source, Verilog Source, C Shell, K Shell, Bash Shell, Plaintext, 
Crypto, LIF, Binary Unknown, ASCII Unknown, and Unknown. 

18. -25. (Canceled) 

26. (New) A method to index a captured object, comprising: 

generating for storage of objects captured during transmission from an 
origination address to a destination address: 

a source address field to indicate an origination address of the 

object; 

a destination address field to indicate a destination address of the 

object; 

a source port field to indicate an origination port of the object; 

a destination port field to indicate a destination port of the object; 

a content field to indicate a content type from a plurality of content 
types identifying a type of content contained in the object; and 

a time field to indicate when the object was captured; and 
storing data in the fields to create a tag, the tag indexing a captured object 
in storage. 
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27. (New) A method to index a captured object, comprising: 

storing data associated with capture of an object by a capture system to 
create a tag indexing the captured object in storage, the data comprising: 

an Ethernet controller MAC address of the capture system that 
captured the object; 

a source Ethernet IP address of the object; 

a destination Ethernet IP address of the object; 

a source TCP/IP port number of the object; 

a destination TCP/IP port number of the object; 

an IP protocol that carried the object when captured by the capture 

system; 

a canonical count of a number of the object within a TCP/IP 

connection; 

a content type of the object; 

an encoding that was used on the object; 

a [[the]] size of the object; 

a timestamp indicating when the capture system captured the 

object; 

a user who requested capture of the object; 
a capture rule that directed capture of the object; 
a hash signature of the object; and 
a hash signature of the tag. 
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